从 URL 下载客户端证书：无需手动步骤的 Java 解决方案

2024-03-19 17:32:07

## 从 URL 下载客户端证书：一种无需手动步骤的方法

问题陈述

在开发 Java Web 服务客户端时，需要使用客户端证书进行身份验证，但证书的来源是 .cer 文件，而不是传统的 keystore 格式。这引发了在不手动下载和添加证书到 keystore 的情况下，从 URL 下载证书的问题。

解决方法

使用 CertificateFactory 和 KeyStore

我们可以使用 java.security.cert.CertificateFactory 和 java.security.KeyStore 类来从 URL 下载证书并将其导入 keystore：

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;

public class DownloadCertificate {

    public static void main(String[] args) throws IOException, GeneralSecurityException {
        // URL of the certificate
        String certUrl = "https://example.com/certificate.cer";

        // Download the certificate from the URL
        URL url = new URL(certUrl);
        BufferedInputStream in = new BufferedInputStream(url.openStream());
        File certFile = new File("certificate.cer");
        FileOutputStream out = new FileOutputStream(certFile);
        byte[] buffer = new byte[1024];
        int bytesRead;
        while ((bytesRead = in.read(buffer, 0, buffer.length)) != -1) {
            out.write(buffer, 0, bytesRead);
        }
        in.close();
        out.close();

        // Load the certificate from the downloaded file
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        Certificate certificate = cf.generateCertificate(new FileInputStream(certFile));

        // Import the certificate into a keystore
        KeyStore keystore = KeyStore.getInstance("JKS");
        keystore.load(null, null);
        keystore.setCertificateEntry("certificate", certificate);

        // Save the keystore to a file
        FileOutputStream keystoreOut = new FileOutputStream("keystore.jks");
        keystore.store(keystoreOut, "password".toCharArray());
        keystoreOut.close();

        System.out.println("Certificate downloaded and imported into keystore successfully.");
    }
}

使用 HttpsURLConnection

另一种方法是使用 javax.net.ssl.HttpsURLConnection 类：

import javax.net.ssl.HttpsURLConnection;
import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;

public class DownloadCertificate {

    public static void main(String[] args) throws IOException {
        // URL of the certificate
        String certUrl = "https://example.com/certificate.cer";

        // Download the certificate from the URL
        URL url = new URL(certUrl);
        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
        BufferedInputStream in = new BufferedInputStream(connection.getInputStream());
        File certFile = new File("certificate.cer");
        FileOutputStream out = new FileOutputStream(certFile);
        byte[] buffer = new byte[1024];
        int bytesRead;
        while ((bytesRead = in.read(buffer, 0, buffer.length)) != -1) {
            out.write(buffer, 0, bytesRead);
        }
        in.close();
        out.close();

        System.out.println("Certificate downloaded successfully.");
    }
}